Steps to reproduce:

1. Create a page "myPage" on the Pages app
2. Create a role which can "Read only" the root node of the website workspace and can "Read/Write" on myPage node (Selected and subNodes)
3. Create a user and assign the role created on step 2
4. Log in with the new user
5. Go to Pages app and within myPage create a multi field component.
6. Fulfil it with a couple of elements and click on "Submit/Save" button
7. An error is thrown because the user can't write on root node

Expected results:
Tho the user do not have ACLs to write on root node, this TMP node which is created to order the nodes of the multi field should work

Actual results:
An exception is thrown when the user tries to create the TMP node on the root level

Workaround:
Give access to everyone on root node (only selected)

Development notes:
The exception is being thrown by info.magnolia.ui.editor.DefaultJcrNodeOrderHandler.applyOrder method. At line 99 gets executed the code:

Node tmpStorage = session.getRootNode().addNode(nodeNameHelper.getUniqueName(session.getRootNode(), TMP_ORDER_STORAGE));

That triggers the "Access denied" exception.